codebee 0.1.6 → 0.1.8

package/app/main.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import logging
 import os
 import re
 import socket
@@ -22,6 +23,9 @@ from urllib.parse import parse_qs, unquote, urlparse
 from core import automation, catalog, flows, jobs, manager, market, market_remote, registry, remote, settings, store
 from core import paths
 from core import health
+import pick_dialog
+
+log = logging.getLogger(__name__)
 
 MIME = {".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8",
         ".css": "text/css; charset=utf-8", ".svg": "image/svg+xml", ".png": "image/png",
@@ -48,10 +52,34 @@ def _utf8_bytes(data):
 
 PORT = 8765  # main() 启动时更新；/api/connect 组装扫码地址用
 
+# 写接口统一限制 JSON 请求体，避免误传文件或异常客户端把 worker 线程和
+# 内存拖垮。16 MiB 足够覆盖任务上下文、故事圣经和附件清单（附件本体走
+# 独立上传接口）。
+MAX_BODY_BYTES = 16 * 1024 * 1024
+# 附件本体用 base64 包装：24 MiB Office 文件编码后约 32 MiB，再留少量 JSON
+# 开销。该上限仍会在 attachments.save_pending 中按扩展名再次精确校验。
+MAX_ATTACHMENT_BODY_BYTES = 34 * 1024 * 1024
+_BODY_UNSET = object()
+
+
+class RequestBodyError(ValueError):
+    """客户端请求体不可解析；status 用于把错误稳定映射为 400/413。"""
+
+    def __init__(self, message, status=400):
+        super().__init__(message)
+        self.status = status
+
 # 侧栏「查看文件」/「目录浏览」跳过的噪音目录（与 store 的习惯一致）
 _SKIP_DIRS_SHARE = {".git", "node_modules", "__pycache__", ".venv", "venv",
                     ".idea", ".vscode", "_attachments"}
 
+# 原生「选择文件夹」对话框：Tk 必须活在自家进程的主线程里（HTTP 请求线程里
+# 建 root 在 macOS 上会崩，Windows 上反复建/销毁也不稳），pick_dialog.py
+# 同文件提供父端 ask_directory()（拉起自身为子进程，参数走 stdin、结果走
+# stdout），这里只持锁防重入。
+# 同时只允许一个原生对话框：对话框开着时第二个请求立即拿到 busy，不排队
+_PICK_LOCK = threading.Lock()
+
 
 class Handler(BaseHTTPRequestHandler):
     server_version = "CodeBee/1.0"
@@ -79,13 +107,38 @@ class Handler(BaseHTTPRequestHandler):
         self._send(code, json.dumps(obj, ensure_ascii=False))
 
     def _body(self):
-        try:
-            n = int(self.headers.get("Content-Length") or 0)
-            if n <= 0:
-                return {}
-            return json.loads(self.rfile.read(n).decode("utf-8"))
-        except Exception:
-            return {}
+        cached = getattr(self, "_parsed_body", _BODY_UNSET)
+        if cached is not _BODY_UNSET:
+            return cached
+        raw_len = self.headers.get("Content-Length")
+        if not raw_len:
+            body = {}
+        else:
+            try:
+                n = int(raw_len)
+            except (TypeError, ValueError):
+                raise RequestBodyError("Content-Length 无效")
+            if n < 0:
+                raise RequestBodyError("Content-Length 无效")
+            limit = getattr(self, "_body_limit", MAX_BODY_BYTES)
+            if n > limit:
+                raise RequestBodyError("请求体过大（最大 %d MiB）" % (limit // (1024 * 1024)), 413)
+            if n == 0:
+                body = {}
+            else:
+                data = self.rfile.read(n)
+                try:
+                    text = data.decode("utf-8")
+                except UnicodeDecodeError:
+                    raise RequestBodyError("请求体必须使用 UTF-8 编码")
+                try:
+                    body = json.loads(text)
+                except (TypeError, ValueError):
+                    raise RequestBodyError("请求体不是有效的 JSON")
+                if not isinstance(body, dict):
+                    raise RequestBodyError("JSON 请求体顶层必须是对象")
+        self._parsed_body = body
+        return body
 
     # ------------------------------------------------------------ 远程访问
     def _forwarded_ip(self):
@@ -210,6 +263,27 @@ class Handler(BaseHTTPRequestHandler):
                 except ValueError:
                     days = 30
                 return self._json(200, usage.summary(days=days))
+            if path == "/api/usage/estimate":
+                from core import usage
+                q = parse_qs(urlparse(self.path).query)
+                ttype = (q.get("type") or [""])[0][:32]
+                try:
+                    edays = max(1, min(3650, int((q.get("days") or ["90"])[0])))
+                except ValueError:
+                    edays = 90
+                return self._json(200, usage.estimate(task_type=ttype, days=edays))
+            if path == "/api/diagnostics/bundle":
+                # 诊断包（zip）：脱敏错误台账 + 用量台账 + 环境元信息，供用户贴 Issue
+                from core import telemetry
+                data = telemetry.build_bundle_bytes(days=30)
+                return self._send(200, data, ctype="application/zip", headers={
+                    "Content-Disposition":
+                        'attachment; filename="codebee-diag-%s.zip"'
+                        % time.strftime("%Y%m%d-%H%M%S")})
+            if path == "/api/diagnostics/issue-summary":
+                # 一键反馈 Issue 的预填摘要（标题+正文，全程脱敏，用户亲手提交）
+                from core import telemetry
+                return self._json(200, telemetry.issue_report(days=30))
             m = re.match(r"^/api/runs/([^/]+)$", path)
             if m:
                 run = store.get_run(m.group(1))
@@ -366,6 +440,14 @@ class Handler(BaseHTTPRequestHandler):
         m = None
         if not self._authed():
             return self._json(401, {"error": "需要访问令牌（启动 CodeBee 时控制台会显示）"})
+        # 所有写接口共用一次严格解析；后续路由再次调用 _body() 时直接取缓存。
+        # 这样 malformed JSON 不会被当成空对象继续执行，也避免同一请求重复读流。
+        self._body_limit = (MAX_ATTACHMENT_BODY_BYTES if path == "/api/attachments"
+                            else MAX_BODY_BYTES)
+        try:
+            self._body()
+        except RequestBodyError as e:
+            return self._json(e.status, {"error": str(e)})
         if path == "/api/control":
             return self._api_control()
         if path == "/api/control/heartbeat":
@@ -374,9 +456,10 @@ class Handler(BaseHTTPRequestHandler):
         # 写操作需要控制权：空闲自动接管；他人持有时 423，由前端引导抢夺。
         # 例外（配置管理类操作全局生效，不被「哪台设备在操作」挡住，
         # 否则告警弹框里的按钮在多端场景会静默 423 失败）：
+        # /api/hooks/run 用自己的令牌鉴权（外部脚本没有设备控制权握手）。
         if path in ("/api/health/op", "/api/models/provider-op", "/api/models/model-op",
                     "/api/models/test-provider", "/api/models/test-model",
-                    "/api/models/probe-wire", "/api/models/key-op"):
+                    "/api/models/probe-wire", "/api/models/key-op", "/api/hooks/run"):
             pass                                    # 落到下方各自路由
         else:
             deny = self._deny_control()
@@ -384,6 +467,8 @@ class Handler(BaseHTTPRequestHandler):
                 return deny
         if path == "/api/tasks":
             return self._api_create_task()
+        if path == "/api/hooks/run":
+            return self._api_hook_run()
         if path == "/api/health/op":
             # 供应商健康告警的手动操作（silence 静默 / reset 手动恢复）
             from core import health
@@ -407,6 +492,8 @@ class Handler(BaseHTTPRequestHandler):
         if path == "/api/dir/save":
             # 「查看文件」弹窗编辑保存（本机 + 控制权 + 防穿越 + mtime 冲突检测）
             return self._api_dir_save()
+        if path == "/api/pick_folder":
+            return self._api_pick_folder()
         m = re.match(r"^/api/tasks/([^/]+)/(archive|delete|retry|rename|continue)$", path)
         if m:
             if m.group(2) == "archive":
@@ -416,7 +503,11 @@ class Handler(BaseHTTPRequestHandler):
                 ok, err, run = store.retry_task(m.group(1))
                 if not ok:
                     return self._json(400, {"error": err})
-                jobs.enqueue({"kind": "orchestration", "run_id": run["id"], "task_id": m.group(1)})
+                queued, qerr = self._enqueue_run(
+                    run["id"], m.group(1),
+                    {"kind": "orchestration", "run_id": run["id"], "task_id": m.group(1)})
+                if not queued:
+                    return self._json(503, {"error": qerr, "run_id": run["id"]})
                 return self._json(200, {"ok": True, "run_id": run["id"]})
             elif m.group(2) == "continue":
                 # 继续连载：在旧任务基础上新建任务（沿用目标/目录/评审设置，章节号衔接）
@@ -424,11 +515,36 @@ class Handler(BaseHTTPRequestHandler):
                     m.group(1), (self._body() or {}).get("chapters"))
                 if not ok:
                     return self._json(400, {"error": err})
-                run = store.create_run("orchestration", new_task["title"],
-                                       task_id=new_task["id"])
-                store.update_task_status(new_task["id"], "queued")
-                jobs.enqueue({"kind": "orchestration",
-                              "run_id": run["id"], "task_id": new_task["id"]})
+                run = None
+                try:
+                    run = store.create_run("orchestration", new_task["title"],
+                                           task_id=new_task["id"])
+                    store.update_task_status(new_task["id"], "queued")
+                except Exception:
+                    # continue_task has already persisted the new task. If run
+                    # initialization fails, close whichever records exist so a
+                    # retry is possible and no task remains queued forever.
+                    log.exception("续写运行初始化失败 task=%s run=%s",
+                                  new_task.get("id"), (run or {}).get("id"))
+                    if run:
+                        try:
+                            store.update_run(
+                                run["id"], status="failed",
+                                error="运行记录创建失败，请稍后重试",
+                                ended_at=time.strftime("%Y-%m-%d %H:%M:%S"))
+                        except Exception:
+                            log.exception("续写运行失败收口失败 run=%s", run.get("id"))
+                    try:
+                        store.update_task_status(new_task["id"], "failed")
+                    except Exception:
+                        log.exception("续写任务失败收口失败 task=%s", new_task.get("id"))
+                    return self._json(503, {"error": "运行记录创建失败，请稍后重试"})
+                queued, qerr = self._enqueue_run(
+                    run["id"], new_task["id"],
+                    {"kind": "orchestration",
+                     "run_id": run["id"], "task_id": new_task["id"]})
+                if not queued:
+                    return self._json(503, {"error": qerr, "run_id": run["id"]})
                 return self._json(200, {"ok": True, "task_id": new_task["id"],
                                         "run_id": run["id"]})
             elif m.group(2) == "rename":
@@ -508,7 +624,11 @@ class Handler(BaseHTTPRequestHandler):
                                     "checking": manager.updates_checking()})
         if path == "/api/selfupdate/apply":
             from core import selfupdate
-            res = selfupdate.apply_upgrade()
+            try:
+                res = selfupdate.apply_upgrade()
+            except Exception:
+                log.exception("自更新任务创建失败")
+                return self._json(503, {"error": "升级任务创建失败，请稍后重试"})
             return self._json(400, res) if res.get("error") else self._json(200, dict(res, ok=True))
         if path == "/api/selfupdate/restart":
             from core import selfupdate
@@ -566,6 +686,13 @@ class Handler(BaseHTTPRequestHandler):
             from core import modelhub
             n, err = modelhub.refresh_models(self._body().get("id") or "")
             return self._json(200, {"ok": bool(n), "count": n, "message": err})
+        if path == "/api/models/add":
+            # 手工添加模型：厂商列表接口调不通时直接填模型名进列表
+            from core import modelhub
+            body = self._body()
+            n, err = modelhub.add_model_manual(body.get("id") or "",
+                                               body.get("name") or "")
+            return self._json(200, {"ok": not err, "count": n, "message": err})
         if path == "/api/models/refresh-all":
             from core import modelhub
             n = modelhub.refresh_all_async()
@@ -707,9 +834,22 @@ class Handler(BaseHTTPRequestHandler):
                 return self._json(400, {
                     "error": "无法推导卸载命令：请在 data/catalog.json 的 \"%s\" 里配置 uninstall 字段"
                              % entry["id"]})
+            if op in ("install", "upgrade", "uninstall"):
+                # 同条目去重闸：已有进行中的管理操作就把本次请求挂到那个 run 上。
+                # 两个同包全局 npm 并发装会互锁成双僵尸（2026-09-18 codex 双开案）
+                active = store.active_mgmt_run(entry["id"])
+                if active:
+                    return self._json(200, {"run_id": active["id"], "deduped": True})
             run = store.create_run("mgmt", "%s %s" % (titles[op], entry.get("name", entry["id"])),
                                    entry_id=entry["id"], op=op)
-            jobs.enqueue({"kind": "mgmt", "run_id": run["id"], "entry_id": entry["id"], "op": op})
+            queued, qerr = self._enqueue_run(
+                run["id"], None,
+                {"kind": "mgmt", "run_id": run["id"], "entry_id": entry["id"], "op": op})
+            if not queued:
+                # 入队失败必须落终态：queued 僵尸会永久堵住去重闸
+                store.update_run(run["id"], status="failed", error=qerr or "enqueue 失败",
+                                 ended_at=time.strftime("%Y-%m-%d %H:%M:%S"))
+                return self._json(503, {"error": qerr, "run_id": run["id"]})
             return self._json(200, {"run_id": run["id"]})
         m = re.match(r"^/api/catalog/([^/]+)/launch$", path)
         if m:
@@ -942,6 +1082,26 @@ class Handler(BaseHTTPRequestHandler):
         parent = "" if p.parent == p else str(p.parent)
         return self._json(200, {"path": str(p), "parent": parent, "dirs": dirs})
 
+    def _api_pick_folder(self):
+        """系统原生「选择文件夹」对话框（工作目录「选择…」/点输入框用）。仅限本机：
+        对话框弹在服务所在机器上，远端触发等于替别人开窗。pick_dialog.ask_directory
+        拉起子进程弹真窗口，选中绝对路径直接回给前端回填；用户取消回空 path。
+        机器没有 tkinter 时 fallback=true，前端回落网页目录弹框，不失去选目录能力。"""
+        ip, fw = self._forwarded_ip()
+        if ip not in ("127.0.0.1", "::1") or fw:
+            return self._json(403, {"error": "目录选择仅限本机使用，请手动输入路径"})
+        body = self._body()
+        if not _PICK_LOCK.acquire(blocking=False):
+            return self._json(200, {"path": "", "busy": True})
+        try:
+            path, err, fb = pick_dialog.ask_directory(str(body.get("initial") or ""),
+                                                      str(body.get("title") or "选择文件夹"))
+        finally:
+            _PICK_LOCK.release()
+        if err:
+            return self._json(200, {"path": "", "fallback": fb, "error": err})
+        return self._json(200, {"path": path or ""})
+
     def _api_dir_scan(self):
         """侧栏文件夹「查看文件」：递归列出该工作目录下的全部文件（左侧文件页树形展示）。
 
@@ -1144,6 +1304,19 @@ class Handler(BaseHTTPRequestHandler):
                                 attachments=saved_paths)
         if not msg:
             return self._json(400, {"error": "运行不存在或消息非法"})
+        # 终态连载 run 收到递话：自动起答疑轮（op=qa）。此前消息只会躺在信箱里
+        # 无人消费——向已完结的连载任务「下达指令」= 石沉大海（2026-09-18 实案）
+        task = store.get_task(run.get("task_id") or "") if run.get("task_id") else None
+        if (task and task.get("serial")
+                and (run.get("status") or "") not in ("queued", "running")):
+            ok, err, new_run = store.retry_task(run["task_id"])
+            if ok:
+                store.update_run(new_run["id"], op="qa", qa_text=text)
+                self._enqueue_run(new_run["id"], run["task_id"],
+                                  {"kind": "orchestration", "run_id": new_run["id"],
+                                   "task_id": run["task_id"]})
+                return self._json(200, {"ok": True, "message": msg,
+                                        "qa_run": new_run["id"]})
         return self._json(200, {"ok": True, "message": msg})
 
     def _api_run_timeline(self, run_id):
@@ -1202,11 +1375,13 @@ class Handler(BaseHTTPRequestHandler):
                 "id": m.get("id"),
             })
 
-        def _emit_step(s):
+        def _emit_step(s, run_id_of_step):
             # 正文只认 output（runner 抽好的最终回答）→ summary。绝不回退读原始
             # 日志：日志是全量事件流（下发提示词回显 + CLI 报错），塞进气泡就成了
             # 「看日志」（2026-09-17 实测症状）；运行中的步骤两者都还没有，留空给
-            # 前端显示「正在执行」占位。
+            # 前端显示「正在执行」占位。log/run 随项下发：气泡上「执行过程」入口
+            # 要按归属 run 打开该步日志（时间线是任务级跨 run 回放，不能拿当前
+            # run id 想当然）。
             body = s.get("output") or ""
             if not body:
                 body = s.get("summary") or ""
@@ -1219,6 +1394,9 @@ class Handler(BaseHTTPRequestHandler):
                 "status": s.get("status") or "",
                 "text": body,
                 "note": s.get("note") or "",
+                "run": run_id_of_step,
+                "log": s.get("log") or "",
+                "followups": s.get("followups") or [],
             })
 
         for r in runs:
@@ -1233,31 +1411,73 @@ class Handler(BaseHTTPRequestHandler):
                     _emit_msg(m)
             for s in steps:
                 if (s.get("status") or "") == "done":
-                    _emit_step(s)
+                    _emit_step(s, r.get("id") or run_id)
             for m in msgs:
                 if not m.get("consumed"):
                     _emit_msg(m)
             for s in steps:
                 if (s.get("status") or "") != "done":
-                    _emit_step(s)
+                    _emit_step(s, r.get("id") or run_id)
         return self._json(200, {
             "run_id": run_id, "status": run.get("status") or "",
             "engine": engine,
             "items": items,
+            "result": self._direct_result(runs[-1] if runs else run, engine),
         })
 
+    def _direct_result(self, latest, engine):
+        """对话页「执行结果」卡的数据：最新 run 到终态后给出确定性摘要——
+        成没成、跑多久、谁执行的、产出了哪些文件。模型最后一轮回答可能只是
+        寒暄/追问（用户反馈：输入"1"跑完 55 秒只见一句"消息可能发错了"），
+        执行结果不能依赖模型自觉交代，由产品明示。"""
+        if engine != "direct" or not latest:
+            return None
+        st = latest.get("status") or ""
+        if st not in ("done", "failed", "cancelled", "timeout"):
+            return None
+        verdict = latest.get("verdict") or {}
+        route = latest.get("route") or {}
+
+        def _sec(a, b):
+            try:
+                return max(0, int(time.mktime(time.strptime(b, "%Y-%m-%d %H:%M:%S")) -
+                                  time.mktime(time.strptime(a, "%Y-%m-%d %H:%M:%S"))))
+            except Exception:
+                return None
+        t0 = latest.get("started_at") or latest.get("created_at")
+        wd, files = "", []
+        try:
+            wd, files = store.run_artifacts(latest.get("id") or "", limit=12)
+            if files and not store.task_step_count(latest.get("task_id") or ""):
+                files = []   # 与 /files 端点同口径：无步骤的任务不给成品（fixture 防误报）
+        except Exception:
+            wd, files = "", []
+        return {
+            "status": st,
+            "error": (latest.get("error") or "") if st in ("failed", "timeout") else "",
+            "executor": route.get("implementer") or verdict.get("impl") or "",
+            "turns": verdict.get("turns") or 0,
+            "duration_s": _sec(t0, latest.get("ended_at") or "")
+                if t0 and latest.get("ended_at") else None,
+            "workdir": wd,
+            "files": files,
+        }
+
     def _api_direct_chat(self, run_id):
-        """直连对话追话：往已结束的 direct run 追加一条消息并自动续跑。
+        """追话：往已结束的 run 追加一条消息并自动续跑。
 
-        机制：消息入旧 run 信箱 → retry_task 起新 run（未消费消息自动继承）
+        直连任务：消息入旧 run 信箱 → retry_task 起新 run（未消费消息自动继承）
         → 入队编排 → _run_direct 看到信箱积压走续轮档（DIRECT_FOLLOWUP）。
-        仅 direct 引擎任务可用；运行中的 run 走既有 /messages（轮间注入）。
+        连载任务：走答疑档（op=qa）——单步只读回答，不再整本重跑（一句
+        「为啥没有第九章」触发全量重评+连环自动续跑，2026-09-18 实案）。
+        运行中的 run 走既有 /messages（轮间注入）。
         写接口已在 do_POST 统一做过设备控制。"""
         run = store.get_run(run_id)
         if not run:
             return self._json(404, {"error": "not found"})
         task = store.get_task(run.get("task_id") or "") if run.get("task_id") else None
-        if not task or task.get("engine") != "direct":
+        is_serial = bool(task and task.get("serial"))
+        if not task or (task.get("engine") != "direct" and not is_serial):
             return self._json(400, {"error": "该任务不是直连任务，请用「下达指令」"})
         if (run.get("status") or "") in ("queued", "running"):
             return self._json(400, {"error": "运行中：消息会随下一步自动送达，无需追话"})
@@ -1282,7 +1502,15 @@ class Handler(BaseHTTPRequestHandler):
         ok, err, new_run = store.retry_task(task["id"])
         if not ok:
             return self._json(400, {"error": err or "无法续跑"})
-        jobs.enqueue({"kind": "orchestration", "run_id": new_run["id"], "task_id": task["id"]})
+        if is_serial:
+            # 答疑档：问题文本显式带上（真实调用失败会把信箱消息 drain 掉，
+            # 换将重试时不能丢问题）；retry_task 只认终态任务，active 已挡
+            store.update_run(new_run["id"], op="qa", qa_text=text)
+        queued, qerr = self._enqueue_run(
+            new_run["id"], task["id"],
+            {"kind": "orchestration", "run_id": new_run["id"], "task_id": task["id"]})
+        if not queued:
+            return self._json(503, {"error": qerr, "run_id": new_run["id"]})
         return self._json(200, {"ok": True, "run_id": new_run["id"]})
 
     def _api_retract_message(self, run_id):
@@ -1341,16 +1569,108 @@ class Handler(BaseHTTPRequestHandler):
         except Exception:
             pass  # 客户端断开是常态，线程随进程退出
 
-    def _api_create_task(self):
-        body = self._body()
+    def _create_and_start(self, body):
+        """建任务并起跑（UI /api/tasks 与外部 webhook /api/hooks/run 共用一条链）。
+
+        返回 (http_status, response_dict)；失败路径都已收口（run/任务状态不会
+        永久卡在排队中）。"""
         try:
             task = store.create_task(body)
         except ValueError as e:
-            return self._json(400, {"error": str(e)})
-        run = store.create_run("orchestration", task["title"], task_id=task["id"])
-        store.update_task_status(task["id"], "queued")
-        jobs.enqueue({"kind": "orchestration", "run_id": run["id"], "task_id": task["id"]})
-        return self._json(200, {"task_id": task["id"], "run_id": run["id"]})
+            return 400, {"error": str(e)}
+        run = None
+        try:
+            run = store.create_run("orchestration", task["title"], task_id=task["id"])
+            store.update_task_status(task["id"], "queued")
+        except Exception:
+            # create_run 已落盘后，update_task_status 仍可能因磁盘/JSON 错误失败。
+            # 这时必须把已经存在的 run 收口，否则 UI 会永久显示「排队中」。
+            log.exception("创建任务运行记录失败 task=%s run=%s", task.get("id"),
+                          (run or {}).get("id"))
+            if run:
+                try:
+                    store.update_run(run["id"], status="failed",
+                                     error="运行记录初始化失败",
+                                     ended_at=time.strftime("%Y-%m-%d %H:%M:%S"))
+                except Exception:
+                    log.exception("收口失败的运行记录失败 run=%s", run.get("id"))
+            try:
+                store.update_task_status(task["id"], "failed")
+            except Exception:
+                log.exception("收口失败的任务状态失败 task=%s", task.get("id"))
+            return 503, {"error": "运行记录创建失败，请稍后重试"}
+        queued, qerr = self._enqueue_run(
+            run["id"], task["id"],
+            {"kind": "orchestration", "run_id": run["id"], "task_id": task["id"]})
+        if not queued:
+            return 503, {"error": qerr, "run_id": run["id"]}
+        return 200, {"task_id": task["id"], "run_id": run["id"]}
+
+    def _api_create_task(self):
+        status, resp = self._create_and_start(self._body())
+        return self._json(status, resp)
+
+    def _api_hook_run(self):
+        """外部触发开任务（webhook，借鉴 emdash/mission-control 的外部集成面）。
+
+        POST /api/hooks/run，头 X-CodeBee-Token；体 {goal 必填, type, workdir,
+        context, title}。令牌取设置 hooks_token（data/settings.json，UI/文件均可
+        配置）：已配置则必须精确匹配；未配置仅放行本机回环。任务链与 UI 完全相同。"""
+        try:
+            tok = str(settings.load().get("hooks_token") or "")
+        except Exception:
+            tok = ""
+        given = (self.headers.get("X-CodeBee-Token") or "").strip()
+        if tok:
+            if given != tok:
+                return self._json(401, {"error": "令牌不匹配"})
+        else:
+            host = str(self.client_address[0]) if self.client_address else ""
+            if host not in ("127.0.0.1", "::1", "::ffff:127.0.0.1"):
+                return self._json(403, {
+                    "error": "未配置 hooks.token，仅允许本机触发；请先在设置中配置令牌"})
+        raw = self._body()
+        payload = {}
+        for k, cap in (("goal", 4000), ("context", 4000), ("type", 40),
+                       ("workdir", 300), ("title", 80)):
+            v = str(raw.get(k) or "").strip()
+            if v:
+                payload[k] = v[:cap]
+        if not payload.get("goal"):
+            return self._json(400, {"error": "goal 必填"})
+        if not payload.get("type"):
+            payload["type"] = "direct"
+        if not payload.get("title"):
+            payload["title"] = payload["goal"][:30]
+        status, resp = self._create_and_start(payload)
+        return self._json(status, resp)
+
+    def _enqueue_run(self, run_id, task_id, job):
+        """入队失败时把已持久化记录收口到 failed，避免 UI 永远显示排队中。"""
+        try:
+            jobs.enqueue(job)
+            return True, ""
+        except Exception:
+            # 不把异常文本（本机路径、命令行参数、供应商响应）返回给客户端；
+            # 详细堆栈只进服务端日志，run 记录也保留稳定的用户可读文案。
+            log.exception("任务入队失败 run=%s task=%s", run_id, task_id)
+            err = "任务入队失败，请稍后重试"
+            try:
+                closed = store.update_run(run_id, status="failed", error=err,
+                                          ended_at=time.strftime("%Y-%m-%d %H:%M:%S"))
+                if closed is None:
+                    # The run may have been removed between creation and enqueue
+                    # (for example, an operator cleared history concurrently).
+                    # Still force the task out of queued so the UI cannot wait
+                    # forever on a record that no longer exists.
+                    raise RuntimeError("运行记录不存在")
+            except Exception:
+                if task_id:
+                    try:
+                        store.update_task_status(task_id, "failed")
+                    except Exception:
+                        pass
+            return False, err
 
     def _api_set_preference(self):
         body = self._body()
@@ -1470,13 +1790,27 @@ def main():
     n_rc = store.recover_orphaned_runs()
     if n_rc:
         print("[CodeBee] 崩溃恢复：%d 个遗留运行标记为 failed（interrupted at startup）" % n_rc)
+    n_mg = store.recover_interrupted_mgmt()
+    if n_mg:
+        print("[CodeBee] 崩溃恢复：%d 个遗留管理操作标记为 failed（interrupted at startup）" % n_mg)
     try:
+        # 孤儿 CLI 清扫走后台线程：PowerShell Get-CimInstance 在部分机器上会慢满
+        # timeout（真实装机 60s，启动被白拖一分钟且无任何提示——看门狗堆栈抓到）。
+        # 清扫是尽力而为的旁路；60s timeout 保证它终会结束，但不能挡服务就绪。
         from core import manager as _mgr
-        n_z = _mgr.sweep_orphan_cli_processes()
-        if n_z:
-            # 服务重启孤儿化的 CLI 孙进程：僵尸 opencode 会劫持后续会话的项目根，
-            # 必须在恢复运行之前清掉（2026-09-17 mo-so「工作目录是 Temp」真凶）
-            print("[CodeBee] 崩溃恢复：清扫 %d 个孤儿 CLI 进程（opencode/codex）" % n_z)
+
+        def _sweep_async():
+            try:
+                n_z = _mgr.sweep_orphan_cli_processes()
+                if n_z:
+                    # 服务重启孤儿化的 CLI 孙进程：僵尸 opencode 会劫持后续会话
+                    # 的项目根（2026-09-17 mo-so「工作目录是 Temp」真凶）
+                    print("[CodeBee] 后台清扫：%d 个孤儿 CLI 进程（opencode/codex/kimi）"
+                          % n_z, flush=True)
+            except Exception:
+                pass
+        threading.Thread(target=_sweep_async, name="orphan-sweep",
+                         daemon=True).start()
     except Exception:
         pass
     from core import bookmeta
@@ -1488,11 +1822,19 @@ def main():
         settings_schema.register_default_namespaces()  # budget/cascade/compaction 配置就绪（幂等）
     except Exception:
         pass
+    try:
+        from core import telemetry
+        telemetry.start_background()  # 匿名错误回传+版本 ping（默认开可关；未配端点自动休眠，延迟 45s 不挡启动）
+    except Exception:
+        pass
     _step("正在启动任务队列…")
     jobs.start_worker()
     n_resume = jobs.resume_interrupted()   # 启动恢复：服务被杀中断的连载任务自动续跑
     if n_resume:
         print("[CodeBee] 已自动恢复 %d 个中断的连载任务（断点续跑）" % n_resume)
+    n_rq = jobs.requeue_pending()   # 启动补队：队列在内存里，重启会让排队项变僵尸
+    if n_rq:
+        print("[CodeBee] 已重新入队 %d 个遗留排队运行" % n_rq)
     _step("正在启动自动化调度…")
     n_auto = automation.start()   # 自动化：加载定时任务并拉起调度线程（错过的一次性任务不补跑）
     if n_auto: